Custom GPTs are tailored chatbot versions built for a specific style, task, or workflow. They can be configured to answer in a particular tone, follow support scripts, or guide users through a process. In security terms, that customization matters because the bot can be made to look authoritative and familiar, even when it is being used for deception.
Attackers can abuse Custom GPTs to impersonate legitimate products, internal help desks, or onboarding tools and steer people toward risky actions such as copying PowerShell commands. The danger is not only in the text itself, but in the trust the interface creates. Defenders should treat unexpected chatbot instructions like any other high-risk request: verify the source, restrict command execution, and monitor for suspicious script use. Awareness training now needs to cover chat-based prompts, not just emails and links.